The Internet has made large amounts of information available to computer users around the world. A tremendous amount of information is exchanged between individual users via public computer networks, e.g., the Internet, and the volume of such information will continue to increase. A particularly attractive aspect of the Internet and networked computers generally is the potential for users to remotely access network-enabled devices to perform functions with the devices while not being physically present. Such remotely accessed devices may include, for example, surveillance cameras, manufacturing equipment, or like devices. An important class of Internet users that employ remotely accessed devices via a computer network are private individuals and professional users that are interconnected via a private network, such as a corporate intranet or local area network (LAN).
Remote access of devices through the Internet has presented many problems. Providing access to remote devices has typically required setup of a dedicated private network or dedicated virtual private network (VPN) for remote device access. A dedicated server within the private network provides for communication with the Internet, and a dedicated telephone line, digital subscriber line (DSL) or like communication interface is used to connect the device to the dedicated server. Such a system involves costly and difficult installation and maintenance. Connection to the remote access device is typically through a modem connection, and data transfer between the device and remote user is slow. Even where DSL or other broadband capability is available for connection to the remote device, real time data transfer of video streams and data intensive operations cannot be effectively carried out. Remote device access systems have also been deficient in that only a single user can access a remote device at a time. This problem is particularly acute in situations when a customer and a support person at different locations both simultaneously wish to access a remote device at a third location.
Remote access of devices via the Internet in many cases involves a user located within one private local area network, and a device located within another, different private network. Information exchange between private computer networks via the Internet has created various security issues associated with protection of information on the private computer networks. Connection of a personal computer in a private network to the Internet can expose confidential data to unauthorized access or hostile attack from virtually anywhere in the world. Some of the sophisticated types of security threats posed by “hackers” include “logic bomb”, “trapdoor”, “Trojan horse”, “virus” and “worm” programs. Such software programs can work independently or via an invoked host program to breach security, disrupt activity and cause damage by destruction of electronic files, alteration of databases, or introduction of computer viruses which affect the operability of the private computer network, computer hardware connected to the private network, and network-accessible devices within the private network.
One approach to private network security has been the use of “firewalls” embodied in hardware and/or software to protect private local area networks from hostile intrusion from the Internet. A firewall is located generally at the junction point or gateway between a private network and a public network such as the Internet and allows a network administrator to selectively offer access to specific types of Internet services to specific LAN users by filtering inbound and outbound traffic. Nearly every private network now has some form of firewall in place to protect internal data from outside intrusion.
Firewalls may operate by inspection of binary data at different layers of the TCP/IP (Transport Control Protocol/Internet Protocol) hierarchy in order to use different criteria for restriction of traffic. Binary data from the highest protocol layer, i.e., the Application Layer, is encapsulated within lower-level protocols all the way to the physical layer for transmission in network media such as twisted pair wire, fiber optic, or wireless channels. Packet filtering firewalls may be carried out at the Internet Protocol or Network layer. Circuit level gateway firewalls work at the TCP or Session Layer, and monitor TCP “handshaking” between packets to determine whether a requested session is legitimate. Application level gateway firewalls or “proxies” are application specific and can filter application specific commands such as http:post and get, which cannot be accomplished by packet filtering or circuit level firewalls. State-full multilayer inspection firewalls can combine the aspects of the above types of firewalls to provide a high level of security.
While firewalls have been largely beneficial for the security of private networks, the implementation of firewalls brings some important drawbacks. Particularly, there is an increasing use of applications that involve data transfer between different, heterogeneous private networks via the Internet. Users increasingly need to make connections from various locations across local-area-networks or wide-area-networks to perform remote diagnostics, calibration, controlling, monitoring or other functions associated with remote network-enabled devices. For example, a scientist or engineer operating within one firewall-protected private network may require access to a network-enabled device in a second firewall-protected private network in order to obtain data, make adjustments to the device remotely, or perform other operations remotely. The firewalls involved will typically be different due to the different security needs and corporate environments involved in the different private networks, and the firewall systems can impose serious limitations to data transfer between the heterogeneous networks.
In one common scenario of this type, a customer in one private corporate network may have a network-enabled instrument or device that needs to be calibrated by expert personnel operating within the instrument manufacturer's private corporate network. In this case, the instrument is connected to the public network behind the customer's corporate firewall, which keeps the network address of the instrument anonymous to the outside public network. The expert personnel will typically be connected to the public network behind the manufacturer's firewall systems, which will prevent the expert personnel from establishing a network connection to the outside public network. The network-enabled device is thus not accessible via the public network by the service personnel. This problem is not easily remedied, as the firewall systems will frequently be different commercial software and/or hardware products, which are not amenable to modification in a manner that will allow the desired connection and communication.
One approach to allowing secured connection between local area networks is to employ virtual private network (VPN) systems. However, such VPN systems require expensive and complex installation of additional hardware and/or software at network access locations. The use of VPN systems also require that network administrators for participating networks implement some kind of joint network security policy, which is difficult or impossible in many situations. Furthermore, VPN systems are still an “emerging” technology, and interoperability among different VPN systems imposes limitations to connection of multiple private networks.
There is accordingly a need for a system that allows quick and easy communication between users and remote, network-enabled devices, that allows collaborative use of remote devices by multiple users, that is simple and inexpensive to install and maintain, that provides secure communication between firewall-protected private networks, and which is generally compatible with emerging, increasingly important applications such as remote diagnostics, calibration, controlling and monitoring functions for remote devices. The present invention satisfies these needs, as well as others, and generally overcomes the deficiencies found in the background art.